T09 · Insecure Skill Coding Practices
Error
- Location
generate_images.py:64- Finding
Shell Command Injection Through Unvalidated Credentials and API Response Values
- Content
View full analysis
- Remediation
View remediation
Security audit
Rn Skills
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a Xiaohongshu content generator, but its image helper uses unsafe shell commands, reads a shell profile for credentials, can make many paid API calls, and writes to hard-coded local paths.
Review carefully before installing. Only use this after replacing shell-based curl/cp calls with safe Python APIs, removing ~/.zshrc credential parsing, enforcing explicit confirmation and job limits for paid API calls, and changing output paths to a user-approved project-local directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
generate_images.py:94- Finding
Unbounded and Excessive Billable API Operations on Script Invocation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
generate_images.py:102- Finding
Hard-Coded Absolute Output Paths Permit Writes Outside the Project Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (34)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
There is a material mismatch between the stated purpose and the behavior described by analysis: the skill is presented as a full Xiaohongshu creation workflow, but the behavior includes undeclared local environment access, fixed local output handling, and failure to implement several promised steps. Misrepresentation is dangerous because users may authorize execution expecting only content creation, while the skill may access secrets or modify the local system in ways that were not transparently disclosed.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This is the strongest concrete issue in the file: a tool capable of arbitrary shell execution is fed a command string assembled from prompt content and credentials. In the context of a content-creation skill, prompts may eventually be user-influenced, making this an especially dangerous path to local command execution.
- Content
python }} }}' ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def get_task_status(task_id):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
A shell-capable tool is invoked with a command string containing a remote task identifier and credentials. Even though the endpoint is fixed, remote-controlled task_id content could abuse the shell boundary, turning a status check into a command execution sink.
- Content
python cmd = f'''curl -s "https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}" \\ -H "Authorization: Bearer {API_KEY}" ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def download_image(url, output_path):
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The download step combines remote URL data with shell execution, creating a high-risk tool-parameter abuse path. If the upstream service or response is tampered with, this can execute arbitrary commands or write attacker-chosen content to local files.
- Content
python def download_image(url, output_path): cmd = f'curl -s "{url}" -o "{output_path}"' subprocess.run(cmd, shell=True) print("=" * 60) print("开始生成穿搭图片...")
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python page0 = f"{dir_path}/page_0.png" cover = f"{dir_path}/cover.png" if os.path.exists(page0) and not os.path.exists(cover): subprocess.run(f'cp "{page0}" "{cover}"', shell=True) print(f" ✓ {cover}") print("\n✅ 全部完成！")
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest frames this as a Xiaohongshu creator and explicitly says it is not for other platforms such as Douyin/Weibo. However, the README's feature list says the skill auto-collects trends from Weibo, Douyin, Vogue, Pinterest, and Instagram, expanding behavior beyond the manifest's stated platform scope.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents capabilities that require shell execution, file reads, and environment variable access, but it does not declare any tool scope or permissions. This weakens least-privilege controls and can cause the agent to access local files or secrets more broadly than users would reasonably expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is written to operate entirely in Chinese and the invocation/output examples assume Chinese-language use, but there is no statement that this is optional or limited to a justified region-specific deployment. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation phrases are broad enough that normal conversation such as '创作小红书' or '收集素材' could trigger a workflow with network access, local file writes, and external API calls. Ambiguous triggering is risky because it can cause unintended execution of side-effectful actions without sufficiently explicit user consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill is not for other platforms, yet the workflow explicitly gathers input from Weibo, Douyin, Pinterest, and Instagram. This inconsistency can mislead users about where data comes from and increases legal, policy, and privacy risk when third-party platform content is collected or repurposed without clear disclosure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The when-to-run section uses ambiguous examples that do not clearly separate harmless drafting from side-effectful automation. Because this skill can perform web searches, generate images through a paid API, and write local files, unclear scope boundaries can lead to accidental over-execution and unexpected cost or data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow sends prompts and content to a third-party image-generation API using an API key, but the skill does not warn that user content will leave the local environment. This creates privacy, confidentiality, and billing risk, especially if prompts contain proprietary, personal, or unpublished material.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill creates output directories, saves files, and updates history.json, but it does not prominently warn users that local files will be modified. Undisclosed file creation and state mutation are dangerous because they can overwrite data, leak sensitive content into predictable locations, or leave persistent artifacts the user did not expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description states the image generation setup supports Chinese prompts better, and the rest of the configuration is oriented around Chinese-specific aesthetics and platform guidance. In a manifest/config context, this can amount to a locale preference baked into the skill without any visible user opt-in or alternative language/locale path.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest limits the skill to 小红书 content creation and explicitly says it is not for other platforms such as 抖音/微博. However, this configuration defines search keyword templates for 微博热点 and 抖音热点, indicating the skill is designed to gather trend material from those platforms as part of its behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill reads the user's ~/.zshrc to recover an API key if the environment variable is absent. Accessing a broad shell profile file is over-privileged for an image helper, risks exposing unrelated secrets/configuration, and normalizes secret scraping from user dotfiles without explicit consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing comments and runtime status/error messages are in Chinese, with no indication that the user can choose another language. This can violate language or locale policy where skills must not force a specific language without user opt-in or documented justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code accesses the DASHSCOPE_API_KEY credential from the process environment and, if missing, falls back to reading ~/.zshrc directly. Although the script prints an error when the key is absent, it does not disclose to the user that it will inspect a shell profile file to obtain a secret.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file uses shell commands for networking and file operations where direct library calls would suffice. In a content-generation skill, introducing generic shell execution substantially increases risk because any future prompt, URL, or response handling bug can become arbitrary command execution on the user's machine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script submits image-generation prompts to a remote DashScope API and includes a bearer token in outbound HTTP requests, then downloads generated images from returned URLs. While progress messages are printed, there is no user-facing disclosure that prompt content and authentication data are being sent to external services.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] def submit_task(prompt): cmd = f'''curl -s "https://dashscope.aliyuncs.com/api/v1/services/aigc/text2image/image-synthesis" \\ -H "Content-Type: application/json" \\ -H "Authorization: Bearer {API_KEY}" \\ -H "X-DashScope-Async: enable" \\
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The script builds a shell command string containing both a secret-bearing API key and unescaped prompt text, then executes it with shell=True. Because prompt content is interpolated directly into a single-quoted curl payload, any quote-breaking or shell metacharacters in prompt data could trigger command injection and arbitrary local command execution.
- Content
python }} }}' ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def get_task_status(task_id):
Tainted flow: 'cmd' from os.environ.get (line 83, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 91% confidence
- Finding
A secret from the environment or ~/.zshrc is inserted into a shell command and executed. Even if the API key itself is not attacker-controlled, combining credential material with shell execution increases the blast radius of injection bugs and exposes the key to process-level leakage and command-line capture.
- Content
python }} }}' ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def get_task_status(task_id):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 84% confidence
- Finding
This call executes a shell command assembled with an API key and task_id. In the current flow task_id originates from a remote service response, so a malformed or attacker-controlled value could break command boundaries and execute unintended shell commands on the host.
- Content
python cmd = f'''curl -s "https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}" \\ -H "Authorization: Bearer {API_KEY}" ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def download_image(url, output_path):
Tainted flow: 'cmd' from os.environ.get (line 83, credential/environment) → subprocess.run (code execution)
Medium
- Category
- Data Flow
- Confidence
- 83% confidence
- Finding
The command executed here includes secret-derived data and a remotely sourced task identifier. This creates an unsafe tainted flow from credentials and network-controlled data into shell execution, which can enable command injection or unintended disclosure in logs and process listings.
- Content
python cmd = f'''curl -s "https://dashscope.aliyuncs.com/api/v1/tasks/{task_id}" \\ -H "Authorization: Bearer {API_KEY}" ''' result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def download_image(url, output_path):
Static analysis
No suspicious patterns detected.